GraphData[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

GraphData.exe
Size

26.3MB
MD5

fd435754ae6d29ad012bcc2e33598155
SHA1

dafde6f44680163f74958bca24ba4b3d4d50c494
SHA256

0dcf3b1c16f39e375e53b2b63de1f267334a075e84aad857b3ce52dcaee73ab2
SHA512

953c5e271c1dbbd799f051ac65813b648c6784371dcc05b01322575f8f72ccf8dc802c619cbd741e105ee783d7695a7f26639cf689842a0af9a9885495e60367
SSDEEP

196608:iu4pZ7YbeY5sbKUP1WjkPX96W3porgKbZq2DX9oFyjDS0GeikgFYEVhCd/b4:iu4L7YaCs2g1Wj4XQWmEKU2DXCkjDuy0

Score

N/A

Malware Config

Signatures

Files

GraphData.exe
.exe windows x64

ae0abe8e897d7c013e7007061e1fcc3a

Code Sign

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Certificate

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

25/05/2021, 00:00

Not After

31/12/2028, 23:59

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:d7:08:a8:91:40:53:19:e2:a5:bb:d3:39:b9:ad:6e
Certificate

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Not Before

22/03/2021, 00:00

Not After

21/03/2036, 23:59

Subject

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

e7:e7:f7:18:06:66:54:6c:e7:a8:da:32:11:9f:5c:e1
Certificate

Issuer

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

Not Before

26/08/2022, 00:00

Not After

26/08/2023, 23:59

Subject

SERIALNUMBER=0317436613,CN=CÔNG TY TNHH PDF SOFTWARE,O=CÔNG TY TNHH PDF SOFTWARE,ST=Ho Chi Minh,C=VN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1310486f20436869204d696e682043697479,1.3.6.1.4.1.311.60.2.1.2=#130b486f20436869204d696e68,1.3.6.1.4.1.311.60.2.1.3=#1302564e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3f:31:db:bc:c7:9c:db:01:51:e5:ac:98:4e:46:5f:db:b1:8b:22:c9
Signer

Actual PE Digest

3f:31:db:bc:c7:9c:db:01:51:e5:ac:98:4e:46:5f:db:b1:8b:22:c9

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

true

Verification

Signing Certificate

SERIALNUMBER=0317436613,CN=CÔNG TY TNHH PDF SOFTWARE,O=CÔNG TY TNHH PDF SOFTWARE,ST=Ho Chi Minh,C=VN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1310486f20436869204d696e682043697479,1.3.6.1.4.1.311.60.2.1.2=#130b486f20436869204d696e68,1.3.6.1.4.1.311.60.2.1.3=#1302564e

09/09/2022, 12:45
Valid: true

Chain 1

SERIALNUMBER=0317436613,CN=CÔNG TY TNHH PDF SOFTWARE,O=CÔNG TY TNHH PDF SOFTWARE,ST=Ho Chi Minh,C=VN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1310486f20436869204d696e682043697479,1.3.6.1.4.1.311.60.2.1.2=#130b486f20436869204d696e68,1.3.6.1.4.1.311.60.2.1.3=#1302564e

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

crypt32

CryptProtectData
CryptUnprotectMemory
CryptProtectMemory
PFXImportCertStore
PFXExportCertStore
CryptQueryObject
CryptMsgGetParam
CryptMsgClose
CryptImportPublicKeyInfoEx2
CryptFormatObject
CertVerifyCertificateChainPolicy
CryptDecodeObject
CertVerifyTimeValidity
CertSetCertificateContextProperty
CertSerializeCertificateStoreElement
CertSaveStore
CertOpenStore
CertNameToStrW
CertGetValidUsages
CertGetNameStringW
CertGetIntendedKeyUsage
CertGetCertificateContextProperty
CertGetCertificateChain
CertFreeCertificateChain
CertFindExtension
CertFindCertificateInStore
CertDuplicateCertificateContext
CertCreateCertificateChainEngine
CertControlStore
CertCloseStore
CertAddCertificateLinkToStore
CertAddCertificateContextToStore
CryptFindOIDInfo
CertFreeCertificateChainEngine
CertEnumCertificatesInStore
CertFreeCertificateContext
CryptUnprotectData

advapi32

EventWriteTransfer
EventWrite
CryptEnumProvidersW
CryptSignHashW
CryptDestroyHash
CryptCreateHash
CryptDecrypt
CryptExportKey
CryptGetUserKey
CryptGetProvParam
CryptSetHashParam
CryptDestroyKey
CryptReleaseContext
CryptAcquireContextW
ReportEventW
RegisterEventSourceW
DeregisterEventSource
ImpersonateLoggedOnUser
RevertToSelf
OpenThreadToken
GetTokenInformation
RegQueryInfoKeyW
RegQueryValueExW
RegOpenKeyExW
RegEnumValueW
RegEnumKeyExW
EnumerateTraceGuidsEx
EventRegister
EventActivityIdControl
RegCloseKey
EventUnregister
EventSetInformation
AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken
EventEnabled

bcrypt

BCryptFinishHash
BCryptGetProperty
BCryptHashData
BCryptEncrypt
BCryptOpenAlgorithmProvider
BCryptSetProperty
BCryptGenRandom
BCryptDestroyKey
BCryptDestroyHash
BCryptDecrypt
BCryptCreateHash
BCryptImportKey
BCryptExportKey
BCryptCloseAlgorithmProvider

iphlpapi

GetAdaptersAddresses
if_nametoindex
GetNetworkParams
GetPerAdapterInfo

kernel32

IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlLookupFunctionEntry
IsDebuggerPresent
InitializeSListHead
DecodePointer
EncodePointer
RtlUnwindEx
InterlockedPushEntrySList
RtlCaptureContext
GetStdHandle
GetCurrentProcess
GetConsoleCP
GetConsoleOutputCP
MultiByteToWideChar
WideCharToMultiByte
GetCPInfoExW
FormatMessageW
CloseHandle
GetExitCodeProcess
CreateProcessW
OpenProcess
K32EnumProcesses
GetProcessId
DuplicateHandle
QueryFullProcessImageNameW
CreatePipe
CancelIoEx
LoadLibraryExW
RaiseFailFastException
GetTickCount64
GetCurrentProcessorNumber
CreateThreadpoolWork
SubmitThreadpoolWork
CloseThreadpoolWork
CreateThreadpoolWait
SetThreadpoolWait
CloseThreadpoolWait
CreateThreadpoolTimer
SetThreadpoolTimer
GetProcAddress
CloseThreadpoolIo
LCIDToLocaleName
FindNLSStringEx
CompareStringEx
FindStringOrdinal
GetUserPreferredUILanguages
InitializeConditionVariable
WakeConditionVariable
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
FileTimeToSystemTime
GetLastError
GetCPInfo
GetCurrentProcessId
GetSystemTime
LocalAlloc
LocalFree
QueryPerformanceCounter
QueryPerformanceFrequency
SetLastError
SystemTimeToFileTime
TzSpecificLocalTimeToSystemTime
WaitForMultipleObjectsEx
WaitForSingleObject
Sleep
GetCurrentThread
WaitForThreadpoolWaitCallbacks
CreateThreadpoolIo
StartThreadpoolIo
CancelThreadpoolIo
LocaleNameToLCID
LCMapStringEx
CompareStringOrdinal
GetLocaleInfoEx
EnumSystemLocalesEx
EnumTimeFormatsEx
GetCalendarInfoEx
EnumCalendarInfoExEx
ResolveLocaleName
SleepConditionVariableCS
CopyFileExW
CreateFileW
DeleteFileW
ExpandEnvironmentStringsW
FindClose
FindFirstFileExW
FlushFileBuffers
FreeLibrary
GetCurrentDirectoryW
GetFileAttributesExW
GetFileInformationByHandleEx
GetFileType
GetFullPathNameW
GetLongPathNameW
GetOverlappedResult
GetSystemDirectoryW
GetTempPathW
QueryUnbiasedInterruptTime
ReadFile
SetFileInformationByHandle
SetFilePointerEx
SetThreadErrorMode
GetDynamicTimeZoneInformation
GetTimeZoneInformation
WriteFile
SetEvent
ResetEvent
CreateEventExW
GetEnvironmentVariableW
CreateMutexExW
CreateThread
ResumeThread
GetThreadPriority
SetThreadPriority
GetConsoleMode
ReadConsoleW
WriteConsoleW
PostQueuedCompletionStatus
WaitForMultipleObjects
QueueUserAPC
TerminateThread
TlsAlloc
TlsFree
FormatMessageA
VerSetConditionMask
CreateIoCompletionPort
GetQueuedCompletionStatus
InitializeCriticalSectionAndSpinCount
SleepEx
CreateEventW
SetWaitableTimer
TlsGetValue
TlsSetValue
GetSystemTimeAsFileTime
CreateWaitableTimerA
VerifyVersionInfoA
InitializeSRWLock
ReleaseSRWLockExclusive
ReleaseSRWLockShared
AcquireSRWLockExclusive
AcquireSRWLockShared
GetCurrentThreadId
GetSystemDirectoryA
LoadLibraryA
GetSystemInfo
VirtualAlloc
VirtualProtect
VirtualFree
SwitchToFiber
DeleteFiber
CreateFiberEx
FindFirstFileW
FindNextFileW
GetModuleHandleW
GetACP
ConvertFiberToThread
ConvertThreadToFiberEx
RtlVirtualUnwind
SetConsoleMode
ReadConsoleA
GetTickCount
MapViewOfFile
CreateFileMappingW
GetProcessHeap
GetFileSize
LockFileEx
UnlockFile
HeapDestroy
HeapCompact
HeapAlloc
LoadLibraryW
HeapReAlloc
DeleteFileA
WaitForSingleObjectEx
CreateFileA
FlushViewOfFile
OutputDebugStringW
GetFileAttributesA
GetDiskFreeSpaceA
GetTempPathA
HeapSize
HeapValidate
UnmapViewOfFile
GetFileAttributesW
CreateMutexW
UnlockFileEx
SetEndOfFile
GetFullPathNameA
SetFilePointer
LockFile
OutputDebugStringA
GetDiskFreeSpaceW
HeapFree
HeapCreate
AreFileApisANSI
TryEnterCriticalSection
FlushProcessWriteBuffers
VirtualQuery
RtlRestoreContext
AddVectoredExceptionHandler
FlsAlloc
FlsGetValue
FlsSetValue
TerminateProcess
SwitchToThread
SuspendThread
GetThreadContext
SetThreadContext
QueryInformationJobObject
GetModuleHandleExW
GetProcessAffinityMask
InitializeContext
GetEnabledXStateFeatures
SetXStateFeaturesMask
InitializeCriticalSectionEx
DebugBreak
GlobalMemoryStatusEx
GetLogicalProcessorInformation
GetLogicalProcessorInformationEx
GetLargePageMinimum
VirtualUnlock
GetWriteWatch
ResetWriteWatch
VirtualAllocExNuma
IsProcessInJob
GetNumaHighestNodeNumber
K32GetProcessMemoryInfo
RaiseException
RtlPcToFileHeader

ncrypt

NCryptDeleteKey
NCryptImportKey
NCryptOpenKey
NCryptFreeObject
NCryptOpenStorageProvider
NCryptGetProperty
NCryptSetProperty

ole32

CoInitializeEx
CoTaskMemAlloc
CoWaitForMultipleHandles
CoCreateGuid
CoGetApartmentType
CoTaskMemFree
CoUninitialize

user32

GetUserObjectInformationW
GetProcessWindowStation
LoadStringW
MessageBoxW

ws2_32

getservbyname
getservbyport
gethostbyaddr
WSAEventSelect
WSAStartup
WSACleanup
bind
closesocket
getpeername
getsockname
getsockopt
ioctlsocket
recv
select
send
setsockopt
shutdown
WSAConnect
WSAGetOverlappedResult
WSAIoctl
WSARecv
WSASend
WSASocketW
FreeAddrInfoExW
GetNameInfoW
GetAddrInfoW
FreeAddrInfoW
GetAddrInfoExW
inet_ntoa
__WSAFDIsSet
connect
htonl
ntohl
WSASetLastError
WSAGetLastError
WSAAddressToStringW
WSAStringToAddressW
getaddrinfo
freeaddrinfo
ntohs
gethostbyname
htons
inet_addr
socket

api-ms-win-crt-math-l1-1-0

powf
modf
ldexp
floor
log10
ceil
log2
frexp
tan
pow
__setusermatherr
sqrt
cos
sin

api-ms-win-crt-heap-l1-1-0

_callnewh
calloc
free
malloc
realloc
_msize
_set_new_mode

api-ms-win-crt-runtime-l1-1-0

_c_exit
_register_thread_local_exe_atexit_callback
_crt_atexit
__p___wargv
_register_onexit_function
_initterm_e
_exit
_initterm
raise
_seh_filter_exe
_get_initial_wide_environment
strerror_s
_cexit
exit
terminate
abort
_beginthreadex
_endthreadex
_initialize_onexit_table
_invalid_parameter_noinfo_noreturn
_initialize_wide_environment
_errno
signal
_configure_wide_argv
_set_app_type
__p___argc

api-ms-win-crt-stdio-l1-1-0

fopen
_wfopen
_fseeki64
fsetpos
fputs
ungetc
fputc
__p__commode
_setmode
setvbuf
fwrite
ftell
fseek
fread
_fileno
fgets
fflush
ferror
feof
_set_fmode
fclose
fgetpos
__stdio_common_vsscanf
__stdio_common_vswprintf
__acrt_iob_func
_get_stream_buffer_pointers
__stdio_common_vsprintf_s
__stdio_common_vsprintf
__stdio_common_vfprintf
fgetc

api-ms-win-crt-string-l1-1-0

__strncnt
_stricmp
_wcsicmp
isdigit
isspace
wcsncmp
strspn
strncmp
strncpy_s
strcat_s
strcpy_s
isupper
strcmp
tolower
_wcsdup
strncpy
islower
strcspn

api-ms-win-crt-locale-l1-1-0

_configthreadlocale
_lock_locales
___mb_cur_max_func
_unlock_locales
localeconv
setlocale
__pctype_func
___lc_locale_name_func
___lc_codepage_func

api-ms-win-crt-convert-l1-1-0

strtoul
strtol
atol
atoi
strtod
strtof

api-ms-win-crt-time-l1-1-0

_time64
_localtime64_s
_gmtime64_s
_gmtime64

api-ms-win-crt-utility-l1-1-0

rand_s
qsort

api-ms-win-crt-filesystem-l1-1-0

_stat64i32
_lock_file
_unlock_file

api-ms-win-crt-environment-l1-1-0

getenv

Exports

Exports

Create
CreateNativeSqliteHandler
Decode
Dispose
DisposeNativeSqliteHandler
DotNetRuntimeDebugHeader
GetData
Open
SendFile
Start

Sections

.text
Size: 4.4MB - Virtual size: 4.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.managed
Size: 10.4MB - Virtual size: 10.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 9.6MB - Virtual size: 9.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 699KB - Virtual size: 873KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 830KB - Virtual size: 829KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 348B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 404KB - Virtual size: 404KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ae0abe8e897d7c013e7007061e1fcc3a

Code Sign

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16Certificate

Extended Key Usages

Key Usages

33:d7:08:a8:91:40:53:19:e2:a5:bb:d3:39:b9:ad:6eCertificate

Extended Key Usages

Key Usages

e7:e7:f7:18:06:66:54:6c:e7:a8:da:32:11:9f:5c:e1Certificate

Extended Key Usages

Key Usages

3f:31:db:bc:c7:9c:db:01:51:e5:ac:98:4e:46:5f:db:b1:8b:22:c9Signer

Signature Validations

Verification

09/09/2022, 12:45 Valid: true

Chain 1

Headers

DLL Characteristics

File Characteristics

Imports

crypt32

advapi32

bcrypt

iphlpapi

kernel32

ncrypt

ole32

user32

ws2_32

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-environment-l1-1-0

Exports

Exports

Sections

.text Size: 4.4MB - Virtual size: 4.4MB

.managed Size: 10.4MB - Virtual size: 10.4MB

.rdata Size: 9.6MB - Virtual size: 9.6MB

.data Size: 699KB - Virtual size: 873KB

.pdata Size: 830KB - Virtual size: 829KB

_RDATA Size: 512B - Virtual size: 348B

.rsrc Size: 11KB - Virtual size: 11KB

.reloc Size: 404KB - Virtual size: 404KB

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Certificate

33:d7:08:a8:91:40:53:19:e2:a5:bb:d3:39:b9:ad:6e
Certificate

e7:e7:f7:18:06:66:54:6c:e7:a8:da:32:11:9f:5c:e1
Certificate

3f:31:db:bc:c7:9c:db:01:51:e5:ac:98:4e:46:5f:db:b1:8b:22:c9
Signer

09/09/2022, 12:45
Valid: true

.text
Size: 4.4MB - Virtual size: 4.4MB

.managed
Size: 10.4MB - Virtual size: 10.4MB

.rdata
Size: 9.6MB - Virtual size: 9.6MB

.data
Size: 699KB - Virtual size: 873KB

.pdata
Size: 830KB - Virtual size: 829KB

_RDATA
Size: 512B - Virtual size: 348B

.rsrc
Size: 11KB - Virtual size: 11KB

.reloc
Size: 404KB - Virtual size: 404KB